It sounds like a necessary but painful change if we want secure by default.
KeePassXC Debian maintainer has removed all network features
31–40 of 367 posts
Re: KeePassXC Debian maintainer has removed all network features
#32Earlier quoted context omitted.
The most secure system is the system with no features! Let's delete everything. #nofeatures #securityonly
Nothing is deleted. Just the default options are now used, as intended and announced upstream. How should a debian openssh be called, with custom patches to integrate systemd logging, enabling all old and insecure cyphers? Or a debian openssl with all legacy cyphers enabled?
> as intended and announced upstream
Meanwhile, from a maintainer of the KeepassXC repo:
> Good luck to you. Really bad decision. We will be sure to let everyone know.
https://github.com/keepassxreboot/keepassxc/issues/10725#iss...
Re: KeePassXC Debian maintainer has removed all network features
#33Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes / exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1]. Remember, the full n…
He removed not only networking but support for yubikey, and autotype.
These are all features that are turned off by default.
Re: KeePassXC Debian maintainer has removed all network features
#34People always crap over LastPass, but when you ask them what they do, it’s some elaborate process relying on thousands of no name packages and devs.
Re: KeePassXC Debian maintainer has removed all network features
#35These kind of "feature changes" in Debian packages is one reason I stay away from Debian.
And it's not just features that might change. A Debian maintainer introduced a bug in the OpenSSL random number generator making it insecure, a couple of years ago.
Re: KeePassXC Debian maintainer has removed all network features
#36For folks interested this issue on GitHub seems to have the latest comments. https://github.com/keepassxreboot/keepassxc/issues/10725
Debian maintainer, Julian Klode, has a "pointed" opinion: > I'm afraid that's not going to happen. It was a mistake to ship with all plugins built by default. This will be painful for a year as users annoyingly do not read the NEWS files they should be reading but there's little that can be done about that. > It is our responsibility to our users to provide them the most secure option possible as the default. All of…
> I'm afraid that's not going to happen. It was a mistake to ship with all plugins built by default. This will be painful for a year as users annoyingly do not read the NEWS files they should be reading but there's little that can be done about that.
I deal with enough packages in my life that do massively breaking changes in point releases though, to be honest. This is reminding me of the good days that `apt upgrade` would uninstall the X-Server because nvidia fucked up their stuff.
Debian is kinda one of the places I expected to be better, and usually it does. (EDIT - And I guess the fact that this is causing a ruckus in testing is an indication of that. lets see how it develops.)
Re: KeePassXC Debian maintainer has removed all network features
#37Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes / exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1]. Remember, the full n…
Whouldn't be less surprising to publish full app as keepassxc and the other packages be named as -localonly or -partial or -secured or -local-and-secured ?
Re: KeePassXC Debian maintainer has removed all network features
#38> It is our responsibility to our users to provide them the most secure option possible as the default. All of these features are superfluous and do not really belong in a local password database manager
While that sounds like a reasonable argument, I think it misses the fact that you need reasonable usability to get users to use your product. E.g there's no way my wife will use KP of she doesn't have autofill, and she'd then revert to someone else's computer like lastpazs or 1password instead, which I'd argue is a worse solution in all ways possible.
The other thing that makes me question this a little, is removing yubikey support and auto type. While you don't get the full advantage of MFA, having a rotating encryption key is still an additional layer of protection. Meanwhile, without auto type you will need to copy-paste usernames and passwords - and listening to the clipboard is much easier than building a key logger.
I mean, if really what you're looking for is barebones, you can also not use a password manager and come up with a cypher instead.
Re: KeePassXC Debian maintainer has removed all network features
#39These kind of "feature changes" in Debian packages is one reason I stay away from Debian. And it's not just features that might change. A Debian maintainer introduced a bug in the OpenSSL random number generator making it insecure, a couple of years ago.
> a couple of years ago
You’re bearing a grudge based on an unintentional bug introduced 18 years ago. Weak take and irrelevant to topic at hand.
Re: KeePassXC Debian maintainer has removed all network features
#40Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes / exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1]. Remember, the full n…
I'm not sure I really agree here. If there's fundamental concern for the security of a software package, why package the software?
What's stopping a malicious actor from including malicious network code outside of the compile flags?